HIPAA Compliance

Work is technical and procedural, and does not substitute for the covered entity's own risk analysis, which is the entity's obligation and cannot be performed on its behalf by a vendor. The first deliverable is a data inventory recording every place protected health information enters, moves through, rests and leaves, because safeguards cannot be specified for flows nobody has written down. Technical safeguards implemented include encryption in transit and at rest, unique user identification with no shared accounts, automatic session termination, role-based access limited to the minimum necessary, and audit logging that records access rather than only changes. Backups are encrypted and their restoration is tested. Every vendor touching PHI is enumerated and placed under a Business Associate Agreement, and vendors that will not sign one are replaced rather than accepted as an exception. Common exposure paths are closed specifically: analytics and advertising tags removed from pages that reveal condition or appointment detail, unencrypted email intake retired, and public form submissions checked for what they log. Findings are documented with dates so the record shows what was verified and when.

Industry Insight